azure.azcollection.azure_rm_containerapp module – Manage Azure Container Apps

Note

This module is part of the azure.azcollection collection (version 4.2.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install azure.azcollection. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: azure.azcollection.azure_rm_containerapp.

New in azure.azcollection 4.0.0

Synopsis

• Create, update, delete, start and stop an Azure Container App.

• Container Apps run in a Managed Environment created with azure.azcollection.azure_rm_containerappenvironment.

Requirements

The below requirements are needed on the host that executes this module.

• python >= 2.7

• The host that executes this module must have the azure.azcollection collection installed via galaxy

• All python packages listed in collection’s requirements.txt must be installed via pip on the host that executes modules from azure.azcollection

• Full installation instructions may be found https://galaxy.ansible.com/azure/azcollection

Parameters

Parameter	Comments
active_revisions_mode string	Active revisions mode for the container app. Choices: "Single" "Multiple"
ad_user string	Active Directory username. Use when authenticating with an Active Directory user rather than service principal.
adfs_authority_url string added in azure.azcollection 0.0.1	Azure AD authority url. Use when authenticating with Username/password, and has your own ADFS authority.
api_profile string added in azure.azcollection 0.0.1	Selects an API profile to use when communicating with Azure services. Default value of latest is appropriate for public clouds; future values will allow use with Azure Stack. Default: "latest"
append_tags boolean	Use to control if tags field is canonical or just appends to existing tags. When canonical, any tags not found in the tags parameter will be removed from the object’s metadata. Choices: false true ← (default)
auth_source string added in azure.azcollection 0.0.1	Controls the source of the credentials to use for authentication. Can also be set via the ANSIBLE_AZURE_AUTH_SOURCE environment variable. When set to auto (the default) the precedence is module parameters -> env -> credential_file -> cli. When set to env, the credentials will be read from the environment variables. When set to credential_file, it will read the profile from ~/.azure/credentials. When set to cli, the credentials will be sources from the Azure CLI profile. subscription_id or the environment variable AZURE_SUBSCRIPTION_ID can be used to identify the subscription ID if more than one is present otherwise the default az cli subscription is used. When set to msi, the host machine must be an azure resource with an enabled MSI extension. subscription_id or the environment variable AZURE_SUBSCRIPTION_ID can be used to identify the subscription ID if the resource is granted access to more than one subscription, otherwise the first subscription is chosen. The msi was added in Ansible 2.6. Choices: "auto" ← (default) "cli" "credential_file" "env" "msi"
cert_validation_mode string added in azure.azcollection 0.0.1	Controls the certificate validation behavior for Azure endpoints. By default, all modules will validate the server certificate, but when an HTTPS proxy is in use, or against Azure Stack, it may be necessary to disable this behavior by passing ignore. Can also be set via credential file profile or the AZURE_CERT_VALIDATION environment variable. Choices: "ignore" "validate"
client_id string	Azure client ID. Use when authenticating with a Service Principal or Managed Identity (msi). Can also be set via the AZURE_CLIENT_ID environment variable.
cloud_environment string added in azure.azcollection 0.0.1	For cloud environments other than the US public cloud, the environment name (as defined by Azure Python SDK, eg, AzureChinaCloud, AzureUSGovernment), or a metadata discovery endpoint URL (required for Azure Stack). Can also be set via credential file profile or the AZURE_CLOUD_ENVIRONMENT environment variable. Default: "AzureCloud"
containers list / elements=dictionary	List of containers that make up the app.
args list / elements=string	Container start command arguments.
command list / elements=string	Container start command.
env list / elements=dictionary	Container environment variables.
name string / required	Environment variable name.
secret_ref string	Name of the container-app secret to pull the value from.
value string	Environment variable value.
image string / required	Container image tag.
name string / required	Container name.
probes list / elements=dictionary	List of probes for the container.
resources dictionary	Container resource requests.
cpu float	CPU cores in decimal notation.
ephemeral_storage string	Ephemeral storage.
memory string	Memory (for example 0.5Gi, 1Gi).
volume_mounts list / elements=dictionary	List of volume mounts inside the container.
mount_path string	Mount path inside the container.
sub_path string	Path inside the volume.
volume_name string	Volume name.
dapr dictionary	Dapr configuration for the container app.
app_id string	Dapr application identifier.
app_port integer	Port on which the app listens.
app_protocol string	Protocol Dapr uses to talk to the app. Choices: "http" "grpc"
enable_api_logging boolean	Enables API logging for the Dapr sidecar. Choices: false true
enabled boolean	Whether Dapr is enabled on the app. Choices: false true
http_max_request_size integer	Increasing max size of request body http server parameter in kilobytes.
http_read_buffer_size integer	Maximum size of HTTP header read buffer in kilobytes.
log_level string	Dapr sidecar log level. Choices: "info" "debug" "warn" "error"
disable_instance_discovery boolean added in azure.azcollection 2.3.0	Determines whether or not instance discovery is performed when attempting to authenticate. Setting this to true will completely disable both instance discovery and authority validation. This functionality is intended for use in scenarios where the metadata endpoint cannot be reached such as in private clouds or Azure Stack. The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority. By setting this to **True**, the validation of the authority is disabled. As a result, it is crucial to ensure that the configured authority host is valid and trustworthy. Set via credential file profile or the AZURE_DISABLE_INSTANCE_DISCOVERY environment variable. Choices: false ← (default) true
environment_id string	Full resource ID of the parent managed environment. Required when creating a container app.
identity dictionary	Managed identity assigned to the container app.
type string	Type of the managed identity. Choices: "SystemAssigned" "UserAssigned" "SystemAssigned, UserAssigned" "None" ← (default)
user_assigned_identities dictionary	User-assigned managed identities. Default: {}
append boolean	Whether to append the provided identities to any already assigned. Choices: false true ← (default)
id list / elements=string	List of resource IDs of user-assigned managed identities. Default: []
ingress dictionary	Ingress configuration for the container app.
additional_port_mappings list / elements=dictionary	Extra port mappings exposed by the container app ingress.
exposed_port integer	Exposed port. Defaults to target_port if unset.
external boolean / required	Whether the port is accessible outside the environment. Choices: false true
target_port integer / required	Port the container listens on.
allow_insecure boolean	Allow insecure HTTP connections. Choices: false true
client_certificate_mode string	Client certificate mode. Choices: "ignore" "accept" "require"
cors_policy dictionary	CORS policy pass-through as an SDK-shaped dict.
custom_domains list / elements=dictionary	Custom domain bindings.
binding_type string	Binding type. Choices: "Disabled" "SniEnabled"
certificate_id string	Resource ID of the certificate.
name string / required	Domain hostname.
exposed_port integer	Exposed TCP port (transport tcp only).
external boolean	Whether ingress is externally reachable. Choices: false true
ip_security_restrictions list / elements=dictionary	IP-based restrictions.
action string / required	Allow or Deny. Choices: "Allow" "Deny"
description string	Rule description.
ip_address_range string / required	CIDR notation for the range.
name string / required	Rule name.
sticky_sessions dictionary	Sticky session configuration for single-revision mode.
affinity string	Sticky session affinity. Choices: "sticky" "none"
target_port integer	Container port that ingress forwards to.
traffic list / elements=dictionary	Traffic weights across revisions.
label string	Associates a traffic label with a revision.
latest_revision boolean	Whether the traffic weight targets the latest revision. Choices: false true
revision_name string	Target revision name.
weight integer	Traffic weight assigned to the revision.
transport string	Transport protocol. Choices: "auto" "http" "http2" "tcp"
init_containers list / elements=dictionary	Container definitions that run before the app containers. Same schema as containers.
args list / elements=string	Init container start command arguments.
command list / elements=string	Init container start command.
env list / elements=dictionary	Init container environment variables.
name string / required	Environment variable name.
secret_ref string	Name of the container-app secret to pull the value from.
value string	Environment variable value.
image string / required	Init container image tag.
name string / required	Init container name.
resources dictionary	Init container resource requests.
cpu float	CPU cores in decimal notation.
ephemeral_storage string	Ephemeral storage.
memory string	Memory (for example 0.5Gi, 1Gi).
volume_mounts list / elements=dictionary	List of volume mounts inside the init container.
mount_path string	Mount path inside the container.
sub_path string	Path inside the volume.
volume_name string	Volume name.
kind string	Metadata used to identify the container app category. workflowapp indicates a Logic Apps standard workflow app. functionapp indicates an Azure Functions app hosted on Container Apps. Choices: "workflowapp" "functionapp"
location string	Resource location. If not set, location from the resource group will be used.
log_mode string	Parent argument.
log_path string	Parent argument.
max_inactive_revisions integer	Maximum number of inactive revisions the app will keep.
name string / required	Name of the container app.
oidc_token string added in azure.azcollection 3.17.0	Direct OpenID Connect (OIDC) token (JWT) used for workload identity authentication. This token is exchanged with Azure AD using OIDC federated identity. Useful in CI systems (for example GitHub Actions, Azure DevOps) where an OIDC token is provided directly by the platform. Can also be set via the AZURE_FEDERATED_TOKEN environment variable.
oidc_token_file_path path added in azure.azcollection 3.17.0	Path to a file containing an OpenID Connect (OIDC) token (JWT) used for workload identity authentication. The file must contain only raw token. This method is commonly used in platforms that materialize OIDC tokens as files Can also be set via the AZURE_FEDERATED_TOKEN_FILE environment variable.
password string	Active Directory user password. Use when authenticating with an Active Directory user rather than service principal.
profile string	Security profile found in ~/.azure/credentials file.
registries list / elements=dictionary	Container image registries the container app pulls from.
identity string	Resource ID of a user-assigned managed identity, or system for system-assigned.
password_secret_ref string	Name of the secret in secrets that contains the registry password.
server string / required	Container registry server (for example myacr.azurecr.io).
username string	Registry username. Omit when using managed identity.
resource_group string / required	The name of the resource group.
revision_suffix string	User-friendly suffix appended to the revision name.
scale dictionary	Scaling configuration.
cooldown_period integer	Cooldown period in seconds after scaling.
max_replicas integer	Maximum replica count.
min_replicas integer	Minimum replica count.
polling_interval integer	Interval in seconds between scaling decisions.
rules list / elements=dictionary	List of KEDA scaling rules. Each item follows the SDK ScaleRule model shape.
secret string	Azure client secret. Use when authenticating with a Service Principal.
secrets list / elements=dictionary	List of secrets exposed to the container app.
identity string	Resource ID of the managed identity used to access the Key Vault secret. Use system for system-assigned.
key_vault_url string	Azure Key Vault URL pointing at the secret.
name string / required	Secret name.
value string	Secret value.
service_binds list / elements=dictionary	List of Container App service bindings (dev-service bindings).
name string	Name of the service bind.
service_id string	Resource ID of the target dev service.
state string	Assert the state of the container app. Choices: "present" ← (default) "absent"
status string	Runtime action to apply after any create/update. start starts a stopped app. stop stops a running app. Choices: "start" "stop"
subscription_id string	Your Azure subscription Id.
tags dictionary	Dictionary of string:string pairs to assign as metadata to the object. Metadata tags on the object will be updated with any provided values. To remove tags set append_tags option to false. Currently, Azure DNS zones and Traffic Manager services also don’t allow the use of spaces in the tag. Azure Front Door doesn’t support the use of Azure Automation and Azure CDN only support 15 tags on resources.
tenant string	Azure tenant ID. Use when authenticating with a Service Principal.
termination_grace_period_seconds integer	Optional duration in seconds the app instance needs to terminate gracefully.
thumbprint string added in azure.azcollection 1.14.0	The thumbprint of the private key specified in x509_certificate_path. Use when authenticating with a Service Principal. Required if x509_certificate_path is defined.
volumes list / elements=dictionary	List of volumes for containers to mount.
workload_profile_name string	Workload profile name to pin the app to. Must exist on the parent environment.
x509_certificate_path path added in azure.azcollection 1.14.0	Path to the X509 certificate used to create the service principal in PEM format. The certificate must be appended to the private key. Use when authenticating with a Service Principal.

Notes

Note

• For authentication with Azure you can pass parameters, set environment variables, use a profile stored in ~/.azure/credentials, or log in before you run your tasks or playbook with az login.

• Authentication is also possible using a service principal or Active Directory user.

• To authenticate via OIDC, pass client_id, tenant and oidc_token or oidc_token_file_path, or set environment variables AZURE_CLIENT_ID, AZURE_TENANT and AZURE_FEDERATED_TOKEN or AZURE_FEDERATED_TOKEN_FILE.

• To authenticate via service principal, pass subscription_id, client_id, secret and tenant or set environment variables AZURE_SUBSCRIPTION_ID, AZURE_CLIENT_ID, AZURE_SECRET and AZURE_TENANT.

• To authenticate via Active Directory user, pass ad_user and password, or set AZURE_AD_USER and AZURE_PASSWORD in the environment.

• Alternatively, credentials can be stored in ~/.azure/credentials. This is an ini file containing a [default] section and the following keys: subscription_id, client_id, secret and tenant or subscription_id, ad_user and password. It is also possible to add additional profiles. Specify the profile by passing profile or setting AZURE_PROFILE in the environment.

See Also

See also

Sign in with Azure CLI

How to authenticate using the az login command.

Examples

- name: Create minimal container app
  azure.azcollection.azure_rm_containerapp:
    resource_group: myResourceGroup
    name: hello
    environment_id: "/subscriptions/xxxx/resourceGroups/myResourceGroup/providers/Microsoft.App/managedEnvironments/myenv"
    ingress:
      external: true
      target_port: 80
      transport: auto
    containers:
      - name: hello
        image: mcr.microsoft.com/k8se/quickstart:latest
        resources:
          cpu: 0.25
          memory: 0.5Gi
    scale:
      min_replicas: 0
      max_replicas: 3

- name: Container app pulling from ACR with user-assigned managed identity
  azure.azcollection.azure_rm_containerapp:
    resource_group: myResourceGroup
    name: private-app
    environment_id: "{{ env_id }}"
    identity:
      type: UserAssigned
      user_assigned_identities:
        id:
          - "/subscriptions/xxxx/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aca-pull"
    registries:
      - server: myacr.azurecr.io
        identity: "/subscriptions/xxxx/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/aca-pull"
    containers:
      - name: app
        image: myacr.azurecr.io/hello:1.0
        resources:
          cpu: 0.5
          memory: 1Gi

- name: Stop the container app
  azure.azcollection.azure_rm_containerapp:
    resource_group: myResourceGroup
    name: hello
    status: stop

- name: Delete the container app
  azure.azcollection.azure_rm_containerapp:
    resource_group: myResourceGroup
    name: hello
    state: absent

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
state complex	Current state of the container app. Returned: always
configuration dictionary	App configuration. Returned: always
id string	Fully qualified resource ID. Returned: always
latest_revision_fqdn string	FQDN of the latest revision. Returned: always
latest_revision_name string	Latest revision name of the app. Returned: always
location string	Resource location. Returned: always
name string	Container app name. Returned: always
provisioning_state string	Provisioning state. Returned: always
template dictionary	App template with containers and scaling. Returned: always

Authors

• Zun Yang (@zunyangc)

Collection links

• Issue Tracker
• Homepage
• Repository (Sources)